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Abstract — This paper addresses multi-user quantum key distri- 
bution networks, in which any two users can mutually exchange 
a secret key without trusting any other nodes. The same network 
also supports conventional classical communications by assigning 
two different wavelength bands to quantum and classical signals. 
Time and code division multiple access (CDMA) techniques, 
within a passive star network, are considered. In the case of 
CDMA, it turns out that the optimal performance is achieved 
at a unity code weight. A listen-before-send protocol is then 
proposed to improve secret key generation rates in this case. 
Finally, a hybrid setup with wavelength routers and passive 
optical networks, which can support a large number of users, 
is considered and analyzed. 

Index Terms — Quantum key distribution, multiple access, cryp- 
tography. 



I. Introduction 

CONSIDER different branches of a bank within a 
metropoHtan area. Suppose any two of them may need to 
exchange a secret key — a sequence of random bits — without 
trusting any other parties. They require to be immune against 
any eavesdropping attacks, during the key exchange, and, also, 
at any time in the future. Except for possibly some initial setup 
requirements, they also require the convenience of remotely 
exchanging the keys without relying on traditional meet-and- 
exchange protocols. Whereas most known cryptographic solu- 
tions to this problem rely on computational complexity, hence 
threatened by future technological advancements, there is one 
emerging technology that can meet all above requirements. 
Quantum key distribution (QKD) is a future-proof protocol, 
whose security results from the laws of physics as modeled 
by quantum mechanics Q, ||2j. This paper studies the above 
and similar multi-user scenarios, where QKD lends itself to 
network environments. 

QKD relies on single-photon technology requiring us to deal 
with challenges of generation, transmission, and detection of 
single photons. A quantum leap forward was recently taken 
by the introduction of decoy-state protocols |[3|, which relaxed 
the need for generating ideal single photons by replacing them 
with weak laser pulses. These weak laser pulses still need to 
go through lossy channels with possibly additional background 
noise. Nevertheless, throughout the past two decades, point- 
to-point QKD has successfully been demonstrated over fiber 
and free-space channels covering distances over 100 km 

and at gigahertz transmission rates over 60 km of optical 
fiber f6|. This distance is large enough to support applications 
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Fig. 1. Different configurations for QKD networks: (a) Access network, 
where all local users can exchange a key with the central office; (b) mesh 
networks, where there is a route between any pairs of users, possibly, via 
some other trusted users. The full mesh network, on the middle right, does 
not require trusting any other nodes, but its required number of links grow 
quadratically with the number of users; and (c) a switch-based network, where 
different users are connected together via a switch, such as a WDM router, 
and can exchange a key using designated wavelengths. 



in local and metropolitan areas without relying on quantum 
repeaters |[7|-fTQ|. 

Several essential steps have recently been taken to make the 
QKD technology available to the public. The most important 
breakthrough is the implementation of QKD over existing 
fiber-optic infrastructures |TT|-|[T6]. This is especially impor- 
tant because QKD protocols are extremely sensitive to the 
background noise, and the crosstalk noise between classical 
and quantum channels substantially deteriorates QKD per- 
formance. Nevertheless, the integration between classical and 
quantum communications is inevitable. It is partly because all 
QKD protocols rely on conventional classical communications 
for their operation, but, more importantly, because it will be 
too costly to use dedicated channels for QKD applications. 
All setups proposed in this paper would therefore support both 
types of communications on a common platform. 

Another key requirement for a more versatile use of QKD is 
its expansion from point-to-point links to multi-user networks, 
which will be at the core of this work. The initial steps toward 
this end have already been taken. Key exchange between one 
central node and several access nodes has been studied and 
developed in the past few years p6| , fTT] ; see Fig.[TJa). A real- 
time demonstration of key exchange over a mesh network of 
several nodes was also demonstrated by the SECOQC project 
1 18 1, and, more recently, in Tokyo QKD network |15|. Such 
examples, despite their being important breakthroughs in the 
field, suffer from a general limitation. In order to enable key 
exchange between any two network users, they often require 
to trust certain intermediate nodes. In the case of access 
networks, the central node must be trusted by all nodes, and, 
in the case of mesh networks, there is not necessarily a direct 
route between any two nodes, unless a full mesh network is 
used; see Fig. [ijb). The latter architecture is too costly with 
the number of required channels scaling quadratically with the 
number of nodes. 

Instead of connecting all nodes directly together, as in a full- 
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mesh network, one can use the concept of switching. This idea 
has been used in a wavelength division multiplexing (WDM) 
network, in which any two nodes are assigned a certain 
wavelength for key exchange and a wavelength router links 
them together |14|; see Fig. [ijc). Such a system, however, 
requires a linearly increasing number of wavelength resources 
with the number of nodes, even if we efficiently reuse the 
channels 1 19|. In the field demonstration of 1 14], there is also 
a specific detection module required per incoming wavelength, 
which makes the system even more costly. 

In this paper, we look at other available dimensions, i.e, 
time and code, to be employed in time/code division multiple- 
access (TDM A/CDMA) QKD networks. They are particularly 
useful if combined with a WDM routing setup, in which case, 
each WDM node can serve as a hub through which multiple 
TDMA/CDMA users can be supported. In particular, a hybrid 
WDM-CDMA setup does not require any network-wide time 
coordination and is suitable if the need for key exchange is 
sporadic. To this end, we first study a TDMA/CDMA based 
multi-user star-topology QKD network, and find average lower 
bounds on the secret key generation rates when decoy-state 
protocols are used. For CDMA we use optical orthogonal 
codes (OOCs) to address each node f20l. It turns out that 
the lower the code weight the higher the key generation rate 
is. It follows that a code with weight one is the best option for 
QKD. This case is equivalent to a TDM A system whose users 
are not synchronized. To get the advantage of both TDMA 
and CDMA, a listen-bef ore-send (LBS) protocol is proposed, 
in which users attempt to pick a free time slot by first listening 
to the channel and then proceed to key exchange only if no 
other user is detected in that slot. 

The rest of the paper is organized as follows. In the next 
section, we review original and decoy-state QKD protocols 
and the existing lower bound on the secret key generation rate 
in the latter case. In Sec. Ill, we study a passive star QKD 
network using TDMA and CDMA as their multiple-access 
methods. We also calculate the average key rate for the LBS 
protocol. Some numerical results will be presented in Sec. IV, 
before introducing hybrid WDM-T/CDMA QKD networks in 
Sec V. Section VI concludes the paper. 

II. Quantum Key Distribution 

In this section, we first review the original BB84 protocol, 
that relies on ideal single photons 1 1 1, and then we present its 
decoy- state variant and the existing lower bounds for secret 
key generation rate in the case of point-to-point QKD links. 

The BB84 protocol enables two parties, namely, Alice and 
Bob, to securely exchange, or, more precisely, extend a secret 
key sequence. The probability of failure in achieving either 
an identical or insecure key, possibly due to the presence 
of eavesdroppers, can be made arbitrarily small. It performs 
this task through the following steps. Step one includes the 
transmission of a raw key by Alice's encoding and sending 
single photons to Bob. Encoding is done in two, randomly 
chosen, nonorthogonal polarization/phase bases, which creates 
maximum uncertainty in decoding if one does not know the 
basis used. The bases will be revealed later, via authenticated 



classical communications, in order that Alice and Bob turn 
their raw keys into sifted keys by keeping only the bits 
for which the same basis has been used for encoding and 
decoding. In the next step, Alice and Bob attempt to correct 
for possible discrepancies in their sifted keys using error- 
correction techniques. If they find the quantum bit error rate 
(QBER) too high, they will abort the protocol, otherwise they 
apply privacy amplification to their corrected keys to bring 
the amount of leaked information to eavesdroppers below a 
desired threshold. 

Since the introduction of BB84, it has been tempting to use 
weak laser pulses, with less-than-unity average photon num- 
bers, instead of ideal single photons. It can, however, be shown 
that by taking advantage of multiple-photon components of a 
coherent state, an eavesdropper can obtain information about 
the key, hence reducing the secret key generation rate. In fact, 
if the channel transmissivity between Alice and Bob is denoted 
by T], the key generation rate will drop proportionally to r]'^ 
if one uses coherent states, whereas it scales with r] if ideal 
single photons are used |21|. It was until the advent of the 
decoy-state protocol that was shown that by a simple trick one 
could get back to the same scaling with r] even if weak laser 
pulses are used. The trick is in Alice, occasionally, changing 
her laser intensity from its typical signal value to some decoy 
values. These random-power pulses provide Alice and Bob 
with extra information that help them better detect potential 
eavesdroppers. 

The secret key generation rate per transmitted pulse, for a 
BB84 protocol that uses decoy coherent states and threshold 
detectors for its implementation, in the limit of an infinitely 
long key, is lower bounded by max[0, P(lo)], where jsj 

P{Yo) = 1/2 {-f{E^)Q^H{E^) + gi[l - H{e,)]) , (1) 

where H{p) = —p\og2p— (1 —p) log2(l —p), for < p < 1, 
f{E^) > 1 is the error correction inefficiency, 

= 1 - (1 - ^o)e-^^ and = [eoFo + 6^(1 - e-^^)]/Q^ 

(2) 

are, respectively, the overall gain and the QBER, 

Qi = Fi/ie-^ and ei = {Yo/2 + edv)/Yi (3) 

are, respectively, the gain and the error rate of a single-photon 
state, fi is the average number of photons in a signal pulse, 
Yi = Yq -\-r]{l — Yq) is the yield of a single-photon state, r] is 
the total transmissivity of the link including the efficiency of 
Bob's detectors, Cd represents the misalignment error, and Yq 
is the probability of a click on the Bob's side without having 
any incident photons from Alice. In a point-to-point link, Yq, 
the yield of the vacuum state, models the photodetectors' dark 
current and the background noise. 

III. QKD OVER Star Networks 

Switching and routing devices are among key components 
of modem communication networks. For quantum applica- 
tions, such as QKD, one should also consider whether the 
employed switching scheme is compatible with the single- 
photon regime of operation. In this section, we consider a 
simple, low cost, switching idea suitable for quantum optical 



Alice box ISSOnm 
Classical channels- 



QKD 




T/CDMA 


Encoder 




Encoder 



(b) 



13 i 



1550 nm Bob box 

►Classical channels 
T/CDMA 
Decoder 



QKD 
Decoder 



{N,-1)T, T = N,T, 



Fig. 2. (a) A star QKD network. All users are connected to each other 
via a transparent star coupler. TDMA or CDMA encoding is used to enable 
multiple access among quantum users, (b) Each user is equipped with an 
Alice box and a Bob box. Classical and quantum signals, in two different 
wavelength bands, are multiplexed and demultiplexed, respectively, in these 
boxes running independently of each other. 



communications. In our setup, N users, at an identical distance 
L from each other, are connected via Sin N x N star coupler. 
A star coupler combines the signals at its input ports and 
broadcasts them to all output ports. Each output port will 
then carry a shadow of each input signal. This results in 
a multiple-access scenario, which must be handled at the 
receiver. Here, we employ the two approaches of TDMA and 
CDMA to distinguish between different users' signals. TDMA 
is, in principle, interference free, but it requires network- 
wide time synchronization. It, however, provides us with 
a reference to which we can compare the performance of 
other proposed techniques such as CDMA. We should also 
bear in mind that the splitting nature of star couplers will 
prevent us from supporting a large number of users. This 
transparent architecture can, however, be used as a private 
local/metropolitan area network, or as the access part of a 
larger optical network, an example of which will be discussed 
in Sec. |Vl 

QKD relies on both classical and quantum communications 
for its key exchange protocol. In a multi-user scenario, we 
should, therefore, support both types of communications for 
all users. It is an ongoing research in finding out the best 
strategy for coexistence of weak, single-photon, quantum 
signals and strong, multi-million-photon, classical pulses on a 
single strand of fiber. The main problem is the crosstalk noise 
induced by classical signals over quantum channels, which can 
fully mask the information in the QKD single photons. Here, 
we use the scheme proposed in |13 | by using the 1550 nm 
wavelength band for classical applications and the 1310 nm 
band for quantum signals. Depending on the employed band 
demultiplexer additional filtering may also be required. In 
our analytical model, we model the above crosstalk effect by 
considering a fixed background noise in our quantum channels. 

Each user, in Fig.[2ja), has an Alice box and a Bob box; see 
Fig. [2jb). Alice boxes include a QKD encoder using a faint 
laser source at the 1310 nm band, followed by a multiple- 
access (MA) encoder, which addresses, either in time or by 
a code, the intended receiver. The output of the MA encoder 
is multiplexed with classical channels in the 1550 nm band. 
The quantum and classical parts can be run independently of 
each other. Bob boxes include a band demultiplexer, which 



Fig. 3. (a) A TDMA time frame for QKD users. Each frame has a width 
T, and is divided into Nc time slots (chips). The width of the laser pulse is 
denoted by Tp and the gate width of single-photon detectors is denoted by 
Td- (b) An example of an OOC sequence. In CDMA QKD, in order to send 
a raw key bit, instead of sending a single pulse, one should send a sequence 
of pulses corresponding to the designated code to the intended receiver. 



separates the quantum and the classical channels, an MA 
decoder, which attempts to extract the intended weak laser 
pulse from the received signal, followed by necessary QKD 
measurements. Circulators can be used to enable bidirectional 
transmission to/from Bob/ Alice boxes. 

Only one QKD measurement module, in our setup, is 
needed per user. This is a cost-effective approach as the 
most expensive elements of a QKD link are commonly the 
avalanche photodiods (APDs) used for single-photon detec- 
tion. Only one user, at a time, can, then, exchange a key 
with a certain Bob box. Proper media- access layer (MAC) 
protocols must then be used to avoid collisions, of attempting 
to exchange a key with the same user, between users. This 
can, however, be coordinated via classical channels before two 
QKD users start their protocol, and is assumed throughout the 
paper. We also assume that the users employ the decoy-state 
variation of the standard BB84 protocol \3] and that channel 
phase/polarization distortions are compensated at the receiver. 

A. TDMA QKD Networks 

In TDMA QKD networks, each receiver is assigned a 
certain time slot out of Nc available time slots. The total frame 
length is denoted by T, which must be longer than the dead 
time of single-photon detectors; see Fig. [3ja). The width of 
each laser pulse is denoted by r^, which must not exceed 
Tc = T /Nc, or the chip period. The MA encoder's task is to 
make sure that the transmitted weak laser pulses will arrive at 
the receiver at the right time. For instance, in order to send a 
raw key bit to user /c, for A: = 1, . . . , A^, the transmitted signal 
state is as follows 



n=0 



n! 



\n)kk{n\. 



(4) 



where \n)k represents an n-photon Fock state corresponding 
to the kth chip, and no photons in any other chips. The MA 
decoder box removes all but the signal in the desired time slot 
by opening the detector gate during the expected arrival time. 
Under these conditions, the secret key generation rate per user 
is lower bounded by 

i^TDMA = max[P(rTDMA)/T, 0], (5) 

where 

^TDMA = (7dc + ^d7xtalk5opt)Td, (6) 
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with 7dc being the total dark count rate generated by pho- 
todetectors in a Bob box, r]^ the quantum efficiency of single- 
photon detectors at Bobs' boxes at 1310 nm, 7xtaik the 
background rate of crosstalk photons leaked from classical 
channels at the receiver per unit of bandwidth, ^opt the optical 
bandwidth of the receiver, and Td > Tp the photodetectors' gate 
width. Throughout the paper, we assume that 7dc and 7xtaik 
are fixed and identical for all users. In principle, because of 
practical constraints on photodetectors, Td can become greater 
than Tc, in which case we have to consider the interference 
from other users as well. Here, we assume that Td < Tc 
so that the above TDM A rate, in ([5]), provides us with a 
reference in comparison with other methods. The total channel 
transmissivity to be used in ([l])-([3]) and ([5]) is given by 

V = VdX IO-^^/^VTV, (7) 

where a is the channel loss factor in dB per unit of length. 
With Na < N active pairs of users operating in the network, 
the total secret key generation rate for the entire network is 
then given by 

^TDMA ~ ^A^TDMA- (8) 

B. CDMA QKD Networks 

In CDMA QKD networks, each receiver is assigned a 
certain code of length Nc by which it can be addressed. In our 
case, we use OOCs, with minimal auto- and cross-correlation 
properties. Each code in an OOC family can be represented by 
an A^c-long sequence of zeros and ones. A bit one in position 
/c of a code sequence represents a pulse in the kth chip in 
Fig. |3jb). Bits zero represent no pulses. In such zero-one 
codes, two code sequences A and B are overlapping whenever 
a pulse in code A is in the same time slot as a pulse in code B. 
The minimal cross-correlation criterion guarantees that once 
such an overlap between two pulses occurs, there will be no 
other overlapping pulses in codes A and B. That will also be 
the case if we shift one code sequence against the other in 
which case the total extent of overlapping between two codes 
does not exceed one pulse duration. In our QKD setup, in 
order to send a raw key bit to a user with an OOC sequence 
of weight w and pulse positions I < ki < /c2, . . . < /c^ < 
the following state is generated in each CDMA frame: 

1 

(9) 

For such a code, the decoder box will combine the received 
pulses in positions ki, ku, into one pulse and pass it to the 
next stage for QKD measurements; see Fig. |4] In the absence 
of any interfering users, and assuming that different compo- 
nents in ^ will be added incoherently |22|, the decoded signal 
pulse will then be Poisson distributed with mean 7//i. 

Both the MA encoding and decoding steps in OOC CDMA 
can be performed transparently using passive optical elements, 
making them compatible to QKD applications. Figure]?] shows 
passive structures for CDMA encoders and decoders, where 
splitters and combiners along with proper delay elements 
have been used to split a single pulse into multiple pulses at 
the transmitter, and to recombine them again at the receiver. 




Fig. 4. Passive encoders and decoders for CDMA QKD. In order to reduce 
the total splitting loss, one can use active switches at the decoder. 

Note that the passive structure for the decoder results in an 
additional loss factor of w, which can be avoided if, instead 
of the splitter, a controllable switch is used in the decoder. 
The switch will direct each pulse in the incoming signal to 
the relevant delay branch in the decoder. For the rest of this 
section, we assume that such an active switching has been 
used in the decoder. It turns out, however, that, in the optimal 
regime of operation, such an assumption is not required. 

A new source of background noise in a CDMA setup is 
the interference from other QKD users. The minimal cross- 
correlation property guarantees that the arbitrarily shifted 
versions of no two codes, belonging to an identical OOC 
family, will overlap at more than one pulse position. There 
will be, however, cases where a pulse from one code will 
interfere with a pulse from another code. In such a case, the 
background noise in the QKD channel will increase. Assuming 
m such interfering users, the background noise will be given 

by 

^CDMA = ^TDMA + mr]/J./w, (10) 

where we assumed that all users are chip synchronous f20l. 
This assumption is not required in practice, but it will simplify 
our analysis and help us overestimate the effect of noise in line 
with the lower bound in ([T]). The secret key generation rate 
per user, in the presence of m such interfering users, is then 
lower bounded by 

4';^)ma = max[P(r(l™l,A)/T, 0]. (11) 

Although, in the worst-case scenario, all active users might 
maximally contribute to the interference level experienced by 
each user, on a typical operating conditions and considering 
the asynchronous nature of a CDMA network, the number of 
interfering users follows a binomial distribution corresponding 
to A^int = Na — 1 trials of a Bernoulli experiment with 
success probability p = w'^/Nc, | ]20| . The collision probability 
p represents w'^ cases of overlap between two codes once one 
shifts one code, chip-by-chip, vis. a total of Nc shifts, against 
the other code. We can then define an effective rate of secret 
key generation rate per user as follows 

^CDMA = ^(^'^mt,P)^CDMA' (1^) 

m=0 

where 

B{m,N,^uP) ^ „ P"^a-rt^"^~"^ (13) 

is the probability of having m interfering users. The total 
effective rate will then be given by ^cdma — NaRcbma- 
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Nominal values used in the numerical results. 
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Fig. 5. Effective key generation rate per user versus the number of active 
pairs of users for (a) TDMA and CDMA QKD networks and (b) the LBS 
protocol. Here w represents the weight of the code, and k represents the 
number of listening periods in the LBS scheme. Nominal values used are 
listed in Table L 



Figure |5ja) shows the effective key generation rate versus 
the number of active users for TDMA and CDMA QKD 
networks. In the latter case, we have considered three different 
values of weight, w, for the code. Given that the number 
of available codes of length Nc and weight w is limited to 
{Nc - l)/w/{w - 1), |[20), for Nc = 16, a maximum of 7 
and 2 users, respectively, can be supported 2it w = 2 and 
w = 3. In Fig. [5ja), however, we have assumed that optical 
orthogonal codes can be assigned to all users. It is interesting 
to see that, whereas in classical optical CDMA an increase 
in the code weight would ultimately result in improving the 
system performance |23J, for QKD applications, it has the 
opposite effect. To see the reason for this difference, note that 
there are two competing terms in ([12]) that affect i^cDMA- 
The parameter p, for the collision probability, quadratically 
increases with w, which would require lower weight values. 



whereas the interference noise in ( 10) is inversely proportional 
to w. The winner of this trade-off turns out to be the former 
mainly because the advantage that we obtain, by increasing w, 
from interference reduction, in a practical regime, is close to 
none. For low values of w, the interference noise, mr]jj./w, in 
([To]), is comparable with the signal rate mr]fi at the receiver, 
because of which ^^cdma ^^^^ for m > 0. In fact, in 
order to get a nonzero value for ^^cdmA' for m > 0, w 
should be roughly greater than 100, which imposes impractical 
constraints on the system. In a practical regime of operation, 
where all terms in ([12]), but the first, vanish, we obtain 



Parameter 


Nominal value 


Average number of photons per signal pulse, /i 


0.48 


Receiver dark count rate, 7dc 


lE-7/ns 


Total coupling and path loss, iq-o^l/io 


6 dB 


crosstalk rate, 7xtaik 


8E-8/ns/GHz 


Quantum efficiency, rjd 


0.3 


Error correction inefficiency, f{E^) 


1.22 


Misalignment error, 


3.3% 


Star coupler size, 


16 


pulse/gate/chip width, Tp = Td = Tc = 1/Bopt 


1 ns 


Number of chips, Nc 


16 


Frame period, T 


NcTc 



which is decreasing with w. The importance of collision 
probability in CDMA QKD networks is also noted in [24\ . 

C. LBS QKD Networks 

In the previous section, we showed that our CDMA QKD 
network would achieve its optimal performance atw = l. The 
case ofw = l corresponds to the sequences of codes with only 
one bit 1, representing a pulse, out of Nc chips. Considering 
the asynchronous nature of CDMA networks, in this case, 
any pairs of users, who wish to exchange a secret key, can 
effectively choose a random chip for their QKD pulses. The 
performance of this scheme would be inevitably lower than 
that of TDMA, because, in the case of CDMA, collisions 
between pulses from different users are also allowed. This 
collision probability can, however, be reduced by employing 
an LBS algorithm. By using the LBS scheme, we achieve the 
simplicity of an asynchronous system, such as CDMA, with a 
performance approaching that of TDMA, as we show below. 

In our LBS QKD setup, each pair of users who need to 
exchange a key first pick a random chip for their pulse posi- 
tion. The receiver, then, listens to the channel for k periods, 
and if no photon is detected during the chosen chip, the two 
users proceed with the key exchange protocol. Otherwise, they 
repeat the same process again, until they find a free time slot. 
This scheme is very similar to the well-known carrier- sense 
multiple access scheme, with the distinction that, in a QKD 
setup, we have to sense signals as weak as single photons. 

The collision probability in an LBS scheme can be approxi- 
mated as follows. Suppose two users A and B are exchanging 
a key by sending QKD pulses at a certain time slot. Under 
chip- synchronous conditions, the probability that another pair, 
after following the LBS protocol, choose to use the same time 
slot is given by = [1 — ^cdmaI^/^c- The effective secret 
key generation rate can then be approximated by 



^LBS - ^B{m,N,^up')R, 



(m) 

CDMA 



(i-p') 



/\Na-1 p 



(15) 



^CDMA = (1 - /Nc)^^-^ RtDMA 



(14) 



which approaches i^xDMA as we let /c ^ oo. 

Figure [5]^b) shows how key generation rate improves when 
the number of listening periods increases. With the nomi- 
nal values used in Table I, it takes on the order of 1000 
listening periods to achieve the same performance as the 



20 



24 



28 



32 




20 



1.8 



to 

^ ''■4 

O) 

■M 
CD 



xlO 



(b) 

TDMA 


LBS. k=50Q ■ ■ 




Na =16 




r = 16 ns 




T, = T/N, 



20 24 28 

Length of code, TV. 



32 



Fig. 6. Effective key generation rate per user versus code length for TDMA, 
CDMA {w = 1), and LBS (k = 500) QKD networks, (a) The pulse width 
is fixed and the period is proportional to code length, (b) The period is fixed 
and the pulse width is inversely proportional to code length. In both graphs, 
Na = 16 and other parameters are taken from Table I. 



TDMA scheme. For the network at its full capacity, that 
is when 16 active pairs of users are present, it takes each 
pair roughly 1 second to generate 15kb of secret key. The 
extra lOOOT = 16/iS overhead for the LBS scheme is then 
negligible compared to the time needed to generate the key. 
Using CDMA, with w = 1, only 6 kb/s of secret key can 
be generated, whereas the effective rate for TDMA is about 
16.5 kb/s per user. 

IV. Numerical Results 

In this section, we study the performance of the system 
against variations in the length of the code, the number of 
users, and the distance, among other parameters. We consider 
the three cases of TDMA, CDMA with ^ = 1, and LBS with 
k = 500 for our comparative study, where the effective key 
generation rates can, respectively, obtained from ([12]), and 
( p3] ). The nominal values used are listed in Table I, which are 
based on practical values affordable by the today's technology. 
The average number of photons /i = 0.48 for signal photons 
maximizes the secret key generation rate for CDMA (w = 1) 
and TDMA QKD networks. The 6 dB path loss corresponds 
to a metropolitan area with roughly 20-30 km in diameter. The 
chosen crosstalk rate is based on the numerical values reported 
in |T3j . The designated dark count and quantum efficiency are 
also achievable by single-photon APDs at the 1300 nm band. 

Figure [6] depicts the effective secret key generation rate per 
user versus code length. Two cases have been considered. In 
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Fig. 7. Effective key generation rate as a function of maximum number of 
users, specified by the size of the star coupler switch, for TDMA, CDMA 
(w = 1), and LBS (k = 500) QKD networks. Solid lines represent rates per 
user, whereas dashed lines represent the total secret key generation rate in 
the network. It is assumed that the number of active users is at its maximum 
possible Na = N, and the code length is fixed at 128 in all cases. Other 
parameters are taken from Table I. 



Fig. [6ja), we have assumed that the chip duration Tc is fixed 
at 1 ns, and we have increased the length of the code, or, 
equivalently, the number of chips, Nc. By doing so, the total 
frame period T = NcTc would increase and that would reduce 
the effective rate, inversely proportional to T, in the case of 
TDMA. By increasing the collision probability, in the case 
of CDMA, would, however, decrease, and this effect would, 
to some extent, balance the reduction in rate due to increase in 
T. The LBS curve lies somewhere between that of CDMA and 
TDMA curves. In Fig. [6jb), however, the frame period T is 
fixed at 16 ns, and increasing Nc implies using shorter chips. 
In this case, the TDMA rate remains constant as it represents, 
effectively, a point-to-point system with a repetition rate of 
1/T. The CDMA and LBS performances, however, improve 
as a result of reduction in the collision probability. We can 
effectively make the chip duration as short as our detectors 
allow. 

Based on the above results, to push the performance of the 
system to its maximum, for a given photodetector with time 
resolution Td and dead time td, one can choose Tp = Tc = Td, 
and, correspondingly, to minimize the crosstalk noise, ^opt = 
1/rp. The period T will then be specified by the maximum 
of Td and Ntc. The number of chips, is then given by 
T/tc. We use this prescription, as summarized in Table I, for 
the upcoming graphs. 

Figure [7] shows the effect of the splitting loss, or equiv- 
alently the maximum number of users supported by the 
network, on the secret key generation rate. As expected, by 
increasing the size of the star coupler, the splitting loss would 
increase and that proportionally reduce the effective rate for 
each pair of users. At its maximum capacity, however, when 
all users are paired up to exchange secret keys, the total rate 
remains almost constant, as shown by the dashed line in Fig.|7] 
This implies that the total number of key bits distributed in 
the network is almost identical to the number of key bits 
generated in a point-to-point system with no splitting loss. 
This fair distribution of keys among users has been achieved 
with no loss in the case of TDMA, and small penalties in the 
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Fig. 8. Effective key generation rate as a function of path loss for TDMA, 
CDMA (w = 1), and LBS (k = 500) QKD networks. At Na = N = 16 and 
7xtaik = SE — 8/ns/GHz, all systems can tolerate over 30 dB of path loss 
(excluding the splitting effect). At higher crosstalk levels (dashed and dotted 
lines) the security distance drops to roughly 50 km, which is still sufficiently 
large for metropolitan area networks. Nominal values are taken from Table I. 



case of CDMA or LBS schemes. 

Finally, Fig.[8]presents the effect of path loss on the effective 
key generation rate for the three schemes of interest. It can 
be seen that by increasing the path loss, the LBS protocol 
approaches the CDMA one, as it becomes harder and harder 
to detect a single photon in only k = 500 listening periods. 
Another important factor shown in Fig. [8] is the dependence of 
the key generation rate on the crosstalk noise. It can be seen 
that even for crosstalk rates three orders of magnitude higher 
than the nominal value in Table I, our multiple-access system 
is capable of supporting 16 users at 10 dB channel loss. This 
makes this approach promising for home users in a passive 
optical network (PON) setup in future generations of optical 
networks. In next section, we propose a setup that combines 
the routing capabilities in WDM networks with the ease of 
access in PON systems to support a large number of QKD 
users. 

V. Hybrid WDM-T/CDMA QKD Networks 

support 



III 



The passive star networks described in Sec. 
quantum and classical communications for a moderate number 
of users offering certain key features. They enable secret key 
exchange between any pairs of users without requiring them to 
trust any other nodes. The transparent nature of star couplers 
also enable coexistence of classical and quantum signals over 
the same infrastructure. The proposed passive structure can 
then be made compatible to PON architectures for consumer 
users. Finally, whereas the repetition rate in a point-to-point 
QKD link is commonly limited by the after-pulse effect in 
single-photon APDs, in our proposed schemes, the detectors' 
dead time is efficiently split between multiple users, either 
synchronously by using TDMA, or asynchronously by using 
CDMA or LBS schemes. To support a large number of users, 
however, we need to bring in another degree of freedom, vis. 
the wavelength. 

Figure [9] illustrates a possible way for network expansion by 
combining WDM routing with each of TDMA/CDMA/LBS 
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Fig. 9. An expansion of a hybrid WDM-T/CDMA setup. Alice and Bob 
boxes are the same as that of Fig. [2jb). A total ofM = NxW users are 
being supported by such a setup, where each users represent a PON with 
a single wavelength, and W is the number of available channels. Different 
users of a PON are being separated in time, code, or by the LBS method. The 
WDM routers must provide a clear path between the intended users. MUX 
and DeMUX, respectively, represent band multiplexer and demultiplexer that 
combine/separate classical and quantum channels. In the above setup, the two 
systems can be run independently of each other, while the classical system 
can be used to coordinate, at/above the physical layer, between quantum users. 



of Fig. [2jb), except that Alice boxes now require tunable 
lasers. Each Bob box is designated by one of the W wave- 
length channels in the 1310 nm band as well as a time slot 
corresponding to the employed TDMA/CDMA/LBS scheme. 
Classical communications can be independently handled, by a 
separate switch, in the 1550nm band. They can, nevertheless, 
be used to coordinate between quantum users. All Bob boxes 
with the same wavelength are accessed via a 1 x splitter, 
similar to a PON system |25l. The WDM router combines a 
maximum of N signals on the same wavelength and directs 
them to the corresponding output port. Proper MAC layer 
protocols will be used to avoid/reduce collisions. In essence, 
the network in Fig. [9l for each wavelength, resembles a passive 
network as in Fig. |2ja). The same rate analysis, with slight 
changes to incorporate the crosstalk noise from quantum users 
on different wavelengths, will then apply to this new setup as 
well. The switching technology at the core network determines 
the extent of this new form of cross talk. With quantum 
network at its full capacity, the background rate in ^ will 
be modified to 



TDMA 



(7dc + ^(i7xtaik^opt)Td + (W - l)waxt, (16) 



where axt represents the crosstalk factor between different 
wavelength channels, assumed identical for all wavelengths. 
Note that this assumption is in line with the lower bound nature 
of ([T]) as, in many cases, the only significant crosstalk terms 
are from adjacent channels. 

Using ([16]), along with ([5]), ([12]), and ( [T5] ), we can 
obtain the secret key generation rate for hybrid WDM- 



TDM A/CDMA/LBS systems. Figure [TO] shows the secret key 
generation rate per user, for the network in Fig. [9] at its full 
capacity, for the WDM-TDM A scheme. We use the nominal 
values given in Table I for the subnetworks, and the horizontal 
axis represents the total number of users M = NW, where, 
here, N = 16. As shown in Fig. [TO] an isolation factor of 
30 dB is sufficient to support hundreds of QKD users. With 
20 dB isolation, the total number of channels that can be 
supported drops to 8. In principle, however, we can always use 
additional optical filters in Fig. [9] to ensure that the crosstalk 



techniques. Here, Alice and Bob boxes are similar to those noise from WDM quantum users is below the desired level. 
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Total Number of users, M 

Fig. 10. Secret key generation rate per user for a WDM-TDMA network, as in 
Fig.|9] versus the total number of users. Rates are calculated at the network's 
full capacity using nominal values in Table I for TDM A subnetworks. 
Different values of intra-channel crosstalk factor, ojxt, are considered. 



VI. Conclusions 



In this paper, well-known techniques in classical multiple- 
access optical communications were applied to quantum cryp- 
tography applications. That enabled multiple users to exchange 
secret keys, via an optical network, without trusting any 
other nodes. The proposed setups offered key features that 
would facilitate their deployment in practice. In all of them, 
classical communications services were integrated with that 
of quantum on a shared platform, which would substantially 
reduce the cost for public and private users. More generally, 
by sharing network resources among many users, the total 
cost per user would shrink, making the deployment of such 
systems more feasible. Another cost-saving feature in our 
setups was their relying on only one QKD detection module 
per user. The setups considered were inspired by existing 
optical access networks as well as future all-optical networks. 
A passive star-coupler network was first studied when multiple 
QKD users could pair up and simultaneously exchange secret 
keys via the network. Each user could independently use 
classical communications as well. Different users could be 
distinguished in time, using a TDMA scheme, or in the code 
space using OOC CDMA. It turned out that, whereas TDMA 
QKD could offer an interference free, or, effectively, a point- 
to-point QKD service, CDMA QKD should deal with the 
interference effect. It was shown that the optimal performance 
for a CDMA QKD system could be achieved if codes with 
weight one were used, for which interference probability 
would be minimum. In this case, the CDMA system was 
similar to the TDMA one, except that no time coordination 
was needed between all network users. To enjoy the benefits of 
both TDMA and CDMA systems, a listen-before- send protocol 
was proposed, whose performance could approach the TDMA 
QKD once the number of listening periods was sufficiently 
large. To support a larger number of users, hybrid WDM- 
TDM A/CDMA architectures, potentially compatible to future 
all-optical networks and PON access systems, were proposed 
and their performance in terms of secret key generation rates 
and numbers of users was studied. 
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